Cyberstudy
PDF p.412 In progress

Penetration Testing

Open PDF at p.412 16 flashcards

Summary

PDF p.412

Penetration testing, or pen testing, uses authorized hacking techniques to discover exploitable weaknesses in security systems. It involves verifying threats, bypassing security controls, actively testing security controls, and exploiting vulnerabilities to assess the effectiveness of security measures.

In plain words

Supplementary — not from your PDF

Penetration testing uses authorized techniques to find exploitable weaknesses and confirm which vulnerabilities are real, so they can be fixed. It always requires authorization and a defined scope. Reconnaissance can be active (directly probing the target, e.g., port scanning, which is more detectable) or passive (gathering information without touching the target, e.g., OSINT). By knowledge level it is known-environment (tester has full information), partially known, or unknown-environment (tester mimics an outsider with no prior information).

Detailed explanation

PDF p.412
  • Penetration Testing Steps
    • Verify a Threat Exists: Identify vulnerabilities using surveillance, social engineering, network scanners, and vulnerability assessment tools.
    • Bypass Security Controls: Look for easy ways to attack the system, such as gaining physical access to a computer.
    • Actively Test Security Controls: Probe for configuration weaknesses and errors, like weak passwords or software vulnerabilities.
    • Exploit Vulnerabilities: Prove high-risk vulnerabilities by exploiting them to gain access to data or install backdoors.
  • Active and Passive Reconnaissance
    • Active Reconnaissance
      • Definition: Actively probing and interacting with target systems to gather information.
      • Techniques: Port scanning, service enumeration, OS fingerprinting, DNS enumeration, web application crawling.
    • Passive Reconnaissance
      • Definition: Gathering information without directly interacting with target systems.
      • Techniques: Open-source intelligence (OSINT), network traffic analysis.
      • Purpose: Less intrusive, lower detection risk, gathers initial information on the target's digital footprint.
  • Known, Partially Known, and Unknown Testing Methods
    • Known Environment Penetration Testing
      • Definition: Tester has detailed knowledge about the target system.
      • Purpose: Assess known vulnerabilities.
    • Partially Known Environment Penetration Testing
      • Definition: Tester has limited knowledge about the target system.
      • Purpose: Gather additional information and assess security controls.
    • Unknown Environment Penetration Testing
      • Definition: Tester has little prior knowledge about the target system.
      • Purpose: Mimic an attacker with no preexisting information, identify potential vulnerabilities.

Important terms

taken from the text above
Verify a Threat Exists
Identify vulnerabilities using surveillance, social engineering, network scanners, and vulnerability assessment tools.
Bypass Security Controls
Look for easy ways to attack the system, such as gaining physical access to a computer.
Actively Test Security Controls
Probe for configuration weaknesses and errors, like weak passwords or software vulnerabilities.
Exploit Vulnerabilities
Prove high-risk vulnerabilities by exploiting them to gain access to data or install backdoors.
Active Reconnaissance
Actively probing and interacting with target systems to gather information.
Passive Reconnaissance
Gathering information without directly interacting with target systems.
Known Environment Penetration Testing
Tester has detailed knowledge about the target system.
Partially Known Environment Penetration Testing
Tester has limited knowledge about the target system.
Unknown Environment Penetration Testing
Tester has little prior knowledge about the target system.
OSINT Open-source intelligence

Examples & real-world scenarios

Supplementary — not from your PDF
  • A scoped, authorized test with written permission.
  • Passive recon using public OSINT.
  • An unknown-environment test simulating an external attacker.

Scenario

A company wants to know how an outsider with no inside knowledge would fare. It commissions an authorized unknown-environment test, with a signed scope and rules of engagement agreed in advance.

Common mistakes

Supplementary — not from your PDF
  • Confusing active (detectable, direct) and passive (low-detection, indirect) reconnaissance.
  • Treating any testing without written authorization as acceptable. It never is.

Practical skills

Supplementary — not from your PDF
  • Distinguish active and passive reconnaissance.
  • Match a knowledge level to a testing goal.

What I should remember

Key Points PDF p.412
  • Penetration Testing Steps
    • Verify Threats: Identify vulnerabilities.
    • Bypass Controls: Find easy attack methods.
    • Test Controls: Probe ffNor weaknesses.
    • Exploit Vulnerabilities: Prove high-risk vulnerabilities.
  • Active and Passive Reconnaissance
    • Active: Probing and interacting with systems.
    • Passive: Gathering information without interaction.
  • Testing Methods
    • Known Environment: Detailed knowledge of the system.
    • Partially Known Environment: Limited knowledge, gather additional information.
    • Unknown Environment: Little prior knowledge, mimic an attacker.